Privacy policy

Last updated: 22 October 2026

Controller

The data controller is the company that owns ClarityContract, established in the Principality of Andorra. To exercise your rights or for any question about your data, write to privacy@claritycontract.com.

What data we process

The content of the contract you upload, the country and language you choose and, if you have an account, your email address and preferences. If you sign in with Google, Microsoft or Apple, the provider shows us your name and, for Google, your photo: we only use them to display them on your profile and do not store them (the photo loads directly from Google's servers).

Documents without an account

The file is read in memory and discarded immediately; it is not stored. The resulting report and the text extracted from the contract (so the full report can be produced if you unlock it) are stored encrypted with a key derived from your private link and deleted automatically after 24 hours. You can delete them earlier from the report itself.

Registered accounts

Sign-in is handled by Google Identity Platform with the provider you choose (Google, Microsoft, Apple or email link). The documents you save (report, proposals, translations and, if you choose, the contract text) are stored encrypted with a key specific to your account, protected by Google Cloud KMS in the European Union. You choose how long they are kept (from 3 days to “forever”, depending on the plan) and can delete them at any time. If you delete your account, its key is destroyed and all data becomes unreadable instantly.

Free diagnosis limit

To limit free diagnoses we do not store your IP address: we keep an encrypted fingerprint that changes every day, cannot be used to track you from one day to the next and is deleted after 48 hours.

Artificial intelligence

The analysis is performed by AI models served by Google Cloud (Vertex AI) in European Union regions, under contractual terms that prohibit using customer data to train models. We have configured the service not to retain the content of requests.

Payments

Card details are processed directly by the bank (Redsys). For subscriptions, the bank gives us a card identifier that can only be used to charge from our merchant account; we store it with your account and it is deleted when you delete the account. We never see your card number.

Technical logs

To run the service and count its usage (sign-ups, analyses and subscriptions), our servers create logs with an internal account identifier, never with the content of contracts. They are kept for 30 days.

Processors

Google Cloud (infrastructure, identity, encryption and AI, in European Union regions) and the bank that operates the payment gateway.

Legal basis and rights

We process data to provide the service you request. You can exercise your rights of access, rectification, erasure, restriction, objection and portability under the GDPR and Andorra's Qualified Law 29/2021 on personal data protection, and lodge a complaint with the Andorran Data Protection Agency or the supervisory authority of your country.

Cookies and local storage

We only use strictly necessary cookies and local storage. See the cookie policy for details. Cookie policy